ML110380206

1 & 2, Edwin I. Hatch Nuclear Plant 1 & 2, and Vogtle Electric Generating Plant, 1 & 2 - Request for Additional Information on Cyber Security Plan

ML110380206
Person / Time
Site:	Hatch, Vogtle, Farley, 05000363
Issue date:	03/03/2011
From:	Martin R Plant Licensing Branch II
To:	Ajluni M Southern Nuclear Operating Co
Martin R, NRR/DORL, 415-1493
References
TAC ME4356, TAC ME4357, TAC ME4358, TAC ME4359, TAC ME4360, TAC ME4361
Download: ML110380206 (4)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 3, 2011 Mr. M. J. Ajluni Nuclear Licensing Director Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway Post Office Box 1295, Bin - 038 Birmingham, AL 35201-1295

SUBJECT:

JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2; EDWIN I. HATCH NUCLEAR PLANT, UNIT NOS. 1 AND 2; VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2-REQUEST FOR ADDITIONAL INFORMATION ON CYBER SECURITY PLAN (TAC NOS. ME4356, ME4357, FARLEY; ME4358, ME4359, HATCH; AND ME4360, ME4361, VOGTLE)

Dear Mr. Ajluni:

By letter dated July 16, 2010 (Agencywide Documents Access and Management System (ADAMS), Accession No. ML102000158), Southern Nuclear Operating Company, Inc. (SNC),

submitted license amendment requests for U.S. Nuclear Regulatory Commission (NRC) review and approval of the facility cyber security plan (CSP) and proposed implementation schedules for the plants named above. The submittal requested approval of the SNC CSP, provided a proposed CSP Implementation Schedule, and included a proposed revision to the facility operating licenses to incorporate the provisions for implementing and maintaining in effect the provisions of the approved CSP.

The NRC staff is reviewing the CSP and the proposed CSP Implementation Schedule and has determined that additional information is required to continue its technical review, as described in the Enclosure. As discussed with your staff on February 24, 2011, we request that a response be provided within thirty (30) days of the date of this letter.

Sincerely,

~~i~anager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-348, 50-364, 50-321, 50-366,50-424, and 50-425

Enclosure:

RAI cc w/encl: Distribution via Listserv

REQUEST FOR ADDITIONAL INFORMATION REGARDING THE LICENSE AMENDMENT REQUEST TO IMPLEMENT A CYBER SECURITY PLAN AT JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2 EDWIN I. HATCH NUCLEAR PLANT, UNIT NOS. 1 AND 2 VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 SOUTHERN NUCLEAR OPERATING COMPANY INC. (SNC)

DOCKET NOS. 50-348, 50-364, 50-321, 50-366, 50-424, AND 50-425 Cyber Security Plan (CSP) Section 4.3: Defense-In-Depth Protective Strategies RAI 1: Telecommunications Interfaces Title 10 of the Code of Federal Regulations (10 CFR), Part 73, Section 73.54(a) requires licensees to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in 10 CFR 73.1 (1). The licensee shall protect digital computer and communication systems and networks associated with:

(i) Safety-related and important-to-safety functions; (ii) Security functions; (iii) Emergency preparedness functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Furthermore, 10 CFR 73.54(c)(2) requires the licensee to apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks.

In the SNC CSP, Section 4.3.2.2, Telecommunications Interfaces, there are several telecommunications interfaces listed.

Not only does the SNC CSP indicate that there are other telecommunications interfaces being used than just those listed, the CSP states: 'These interfaces are not identified as threat vectors in industry standards and are acceptable cyber security domain boundary interfaces. No controls are identified in Appendices Band C for these interfaces. As a result, the CDA [critical digital asset] boundary for cyber security purposes ends at the CDA's telecommunications interface looking outward:'

Explain how SNC plans to address the known and industry-documented threat vectors associated with the telecommunications interfaces listed (and others that may be used) to provide high assurance against a cyber attack. Explain why the numerous controls listed in Enclosure

-2 Nuclear Energy Institute (NEI) 08-09,1 Appendices D and E, are not appropriate for use to ensure that the compromise or misuse of telecommunications interfaces does not adversely impact safety, security, or emergency preparedness functions. Furthermore, explain how these interfaces (and the others that are not listed) can perform the same function as boundary devices such as a data diode or appropriately configured firewall.

RAI 2: Interfaces to Field Sensors, Actuators, and other Field Devices Section 73.54(a) requires licensees to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in 10 CFR 73.1 (1). The licensee shall protect digital computer and communication systems and networks associated with:

(i) Safety-related and important-to-safety functions; (ii) Security functions; (iii) Emergency preparedness functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Furthermore, 10 CFR 73.54(c)(2) requires the licensee to apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks.

In the SNC CSP, Section 4.3.2.3, Interfaces to Field Sensors, Actuators, and other Field Devices, there are several telecommunications interfaces listed. The SNC CSP states

'1nterfaces to field devices provide the primary means by which scoped systems receive and transmit information:' The CSP also states: "These interfaces enter through the inpuUoutput (I/O) subsystem of the CDA. The National Institute of Standards and Technology (NIST) SP 800-53, Draft NIST SP-800-82 and International Society of Automation 99.02.2009 standards do not identify sensors/actuators interfaced via the 110 SUb-system as a threat vector or candidate for security controls. There are no cyber security controls for this category of interfaces, and as a result, the CDA boundary for cyber security purposes ends at the CDA field side of the I/O interface. The following interfaces are considered acceptable field 1/0 interfaces. The interfaces described below [already listed above] and the connected field devices require no cyber security controls:'

Explain how SNC plans to address the known and industry-documented threat vectors associated with Interfaces to Field Sensors, Actuators, and other Field Devices listed (and others that may be used) to provide high assurance against a cyber attack. Explain why the numerous controls listed in NEI 08-09, Appendices 0 and E, are not appropriate for use to ensure that the compromise or misuse of Interfaces to Field Sensors, Actuators, and other Field Devices interfaces do not adversely impact safety, security, or emergency preparedness functions.

1 Agencywide Documents Access and Management System, Accession No. ML101180437

March 3, 2011 Mr. M. J. Ajluni Nuclear licensing Director Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway Post Office Box 1295, Bin - 038 Birmingham, AL 35201-1295

SUBJECT:

JOSEPH M. FARLEY NUCLEAR PLANT, UNITS 1 AND 2; EDWIN I. HATCH NUCLEAR PLANT, UNIT NOS. 1 AND 2; VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2-REQUEST FOR ADDITIONAL INFORMATION ON CYBER SECURITY PLAN (TAC NOS. ME4356, ME4357, FARLEY; ME4358, ME4359, HATCH; AND ME4360, ME4361, VOGTLE)

Dear Mr. Ajluni:

By letter dated July 16, 2010 (Agencywide Documents Access and Management System (ADAMS), Accession No. ML102000158), Southern Nuclear Operating Company, Inc. (SNC),

submitted license amendment requests for U.S. Nuclear Regulatory Commission (NRC) review and approval of the facility cyber security plan (CSP) and proposed implementation schedules for the plants named above. The submittal requested approval of the SNC CSP, provided a proposed CSP Implementation Schedule, and included a proposed revision to the facility operating licenses to incorporate the provisions for implementing and maintaining in effect the provisions of the approved CSP.

The NRC staff is reviewing the CSP and the proposed CSP Implementation Schedule and has determined that additional information is required to continue its technical review, as described in the Enclosure. As discussed with your staff on February 24, 2011, we request that a response be provided within thirty (30) days of the date of this letter.

Sincerely, IRA!

Robert E. Martin, Senior Project Manager Plant licenSing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-348, 50-364, 50-321, 50-366, 50-424, and 50-425

Enclosure:

RAI cc w/encl: Distribution via Listserv DISTRIBUTION PUBLIC LPL2-1 R/F RidsAcrsAcnw_MailCTR Resource RidsNrrDorlDpr Resource RidsNrrDorlLpl2-1 Resource RidsRgn2MailCenter Resource RidsNrrLAMOBrien Resource RidsNrrPMFarley Resource RidsOgcRp Resource PPederson, NSIR CErlanger, NSIR RidsNrrPMHatch Resource RidsNrrPMVogtle Resource ADAMS A ccesslon. Num ber: ML110380206 t d 2/02/11

• b?'L memo dae OFFICE LPL2-1/PM LPL2-1/PM LPL2-1/LA NSIR/DSP/BC LPL2-1/BC LPL2-1/PM NAME RMartin IPBoyie MO'Brien CErlanger

• GKulesa RMartin DATE 02/24/11 03/03/11 02/28/11 2/02111 03/03/11 03/03/11 OFFICIAL RECORD COPY